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Abstract 

We review Grover's algorithm by means of a detailed geometrical interpre- 
tation and a worked out example. Some basic concepts of Quantum Me- 
chanics and quantum circuits are also reviewed. This work is intended for 
non-specialists which have basic knowledge on undergraduate Linear Alge- 
bra. 



1 Introduction 



The development of quantum software and hardware is an exciting new area posing 
extremely difficult challenges for researchers all over the world. It promises a new era in 
Computer Science, but it is not clear at all whether it will be possible to build a hardware 
of reasonable size. Quantum hardware of macroscopic sizes suffer the decoherence effect 
which is an unsurmountable tendency to behave classically. 

An important landmark in hardware development is the experience performed at 
IBM's lab in San Jose, California, which factored the number 15 into its prime factors 
using a quantum algorithm (Shor's algorithm [T]) executed in a molecule, perfluorobu- 
tadienyl iron complex [2J. This "quantum computer" has seven "quantum bits". Such 

'Contents based on lecture notes from graduate courses in Quantum Computation given at LNCC. 
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insignificant amount of bits that could be manipulated in the experience shows the chal- 
lenge in hardware development. 

Quantum software development is facing difficulties too, though the superiority of 
quantum circuits over classical ones was already established. In this context, Grover's 
algorithm [3J|I] plays an important role, since it provides a proof that quantum computers 
are faster than classical ones in database searching. The best classical algorithm for 
an unstructured database search has complexity O(N), without possibility of further 
improvement, while the best quantum algorithm has complexity 0(y/N). 

Historically, Deutsch's algorithm [3] was the first example of a quantum circuit faster 
than its classical counterpart, while Bernstein and Vazirani jS] and Simon \7] provided 
the first examples of quantum algorithms exponentially faster than their classical coun- 
terparts. These algorithms determine some sort of functions' periods and their only 
application seems to be for proving that quantum circuits are faster than classical ones. 

Some of the most impressive results so far in quantum computation are the Shor's al- 
gorithms pQ for factoring integers and for finding discrete logarithms, which also provided 
an exponential speed up over the known classical algorithms. Shor's results attracted a 
lot of attention because they render most of current cryptography methods useless, if we 
assume it is possible to build quantum hardware of reasonable size. 

This work is an introductory review of Grover's algorithm. We have put all our efforts 
to write as clear as possible for non-specialists. We assume familiarity with undergraduate 
Linear Algebra, which is the main mathematical basis of Quantum Mechanics. Some 
previous knowledge of Quantum Mechanics is welcome, but not necessary for a persistent 
reader. The reader can find further material in [%| IHj ITU I II 1| I12 [ ll.Sj. 

Section 2 reviews basic notions about classical computers preparing for the quantum 
generalization, which is presented in Section 3. Section 4 introduces the notion of quan- 
tum circuits and presents some basic examples. Section 5 describes Grover's algorithm. 
Sections 6 and 8 give details of the geometrical interpretation while Section 7 presents a 
worked out example. Finally, Section 9 shows the decomposition of Grover's circuit in 
terms of the universal gates. 

2 The Classical Computer 

A classical computer can be understood in a very broad sense as a machine that reads a 
certain amount of data, encoded as zeroes and ones, performs calculations, and prints in 
the end output data as zeroes and ones again. Zeroes and ones are states of some physical 
quantity, the electric potential in classical computers. Internally, a zero is a state of low 
electric potential and a one is a state of high electric potential. This point is crucial to 
the generalization we will discuss ahead. 

Zeroes and ones form a binary number which can be converted to decimal notation. 
Let us think of the computer as calculating a function 

/:{0,...,iV-l}^{0,...,iV-l}, 
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Figure 1: Outline of the classical computer. 



where N is a number of the form 2 n (n is the number of bits in the computer memory). 
We assume without loss of generality that the domain and codomain of / are of the 
same size (/ is a function because one input cannot generate two or more outputs). We 
represent the calculation process in Fig. ^ where on the left hand side we have the value 
of each bit (zero or one). The process of calculation goes from left to right, and the 
output is stored in the same bits on the right hand side. 

Usually / is given in terms of elementary blocks that can be implemented in practice 
using transistors and other electrical devices. The blocks are the AND, OR and NOT 
gates, known as universal gates (This set could be reduced further since OR can be written 
in terms of AND and NOT). For example, the circuit to add two one-bit numbers modulo 
2 is given in Fig. [2j The possible inputs are 00, 01, 10, 11, and the corresponding outputs 
are 00, 01, 11, 10. The inputs are prepared creating electric potential gaps, which create 
electric currents that propagate through the wires towards right. The gates are activated 
as time goes by. The meter symbols on the right indicate that measurements of the 
electric potential are performed, which tell whether the output value of each bit is zero 
or one. The second bit gives the result of the calculation. The wire for the output of 
the first bit is artificial and unnecessary; at this point, it is there simply to have the 
codomain size of the function / equal to the domain size. This circuit, without the first 
bit output wire, is the circuit for the XOR (exclusive OR) gate in terms of the universal 




Figure 2: The circuit to add two one-bit numbers modulo 2. 
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gates. 

The circuit of Fig. [21 is irreversible, since the gates AND and OR are irreversible. If 
the output of the AND gate is 0, nobody can tell what was the input, and similarly when 
the output of the OR gate is 1. This means that the physical theory which describes 
the processes in Fig. [2] must be irreversible. Then, the AND and OR gates cannot be 
straightforwardly generalized to quantum gates, which must be reversible ones. 

However, the circuit of Fig. [2]can be made reversible. Although the following descrip- 
tion is unnecessary from the classical point of view, it helps the quantum generalization 
performed in the next sections. We employ the controlled-NOT (CNOT) gate of Fig. 01 
The bits a and b assume values either or 1. The value of the first bit (called the control 
bit) never changes in this gate; the second bit (called the target bit) is flipped only if 
a = 1. If a = 0, nothing happens to both bits. The gate © is a NOT gate controlled 
by the value of the first bit. Now it is easy to verify that the value of the second bit for 
this gate is a + b (mod 2). The CNOT gate is not a universal building block for classical 
circuits, but its quantum counterpart is a basic block of quantum circuits. 

We have described the reversible counterpart of the XOR gate. What is the reversible 
counterpart of the AND gate? The answer employs the Toffoli gate (Fig. which is a 
generalization of the CNOT gate with two control bits instead of one. The value of the 
third bit (target) is inverted only if both a and b are 1, otherwise it does not change. 
The following table describes all possible inputs and the corresponding outputs: 



000 - 


-» 000 


001 - 


-> 001 


010 - 


-» 010 


011 - 


-» 011 


100 - 


-> 100 


101 - 


-> 101 


110 - 


-» 111 


111 - 


-» 110 



The AND gate can be replaced by the Toffoli gate simply by taking c = 0. The output of 
the third bit is then a AND b (The reversible circuit for the OR gate is a little cumbersome 
because it requires more than one Toffoli gate, so we will not describe it here). 

Another feature implicit in Fig. [21 that cannot be performed in quantum circuits 



a + b (mod 2) 



Figure 3: Classical controlled-NOT (CNOT) gate. 
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c 



c + ab (mod 2) 



Figure 4: Classical TofFoli gate. 



is FANOUT. Note that there are bifurcations of wires; there is no problem to do this 
classically. However, this is forbidden in quantum circuits, due to the "no cloning" 
theorem (see |1U| p. 162). Classical FANOUT can be obtained from the CNOT gate by 
taking 6 = 0. The value of the first bit is then duplicated. 

Consider again Fig. ^ If the computer has n bits, there are 2 n possible inputs. For 
each input there are 2 n possible outputs, therefore the number of possible functions / 
that can be calculated is 2 n2 ™. All these functions can be reduced to circuits using the 
universal gates. That is what a classical computer can do: calculate 2 n2 ™ functions. This 
number is astronomical for computers with 1 gigabyte, that is a typical memory size for 
good personal computers nowadays. 

Another important issue is how fast can the computer calculate these functions. The 
answer depends on the number of gates used in the circuit for /. If the number of 
elementary gates increases polynomially with n, we say that the circuit is "efficient". If 
the number of gates increases exponentially with n, the circuit is "inefficient". This is 
a very coarse method to measure the efficiency, but it is useful for theoretical analysis 
when n is large. Note that we are thinking of computers of variable size, which is not 
the case in practice. In fact, instead of referring to actual computers, it is better to 
use a Turing machine, which is an abstract model for computers and softwares as a 
whole |14j . Similarly, quantum computers and their softwares are abstractly modeled as 
the quantum Turing machine |15| . The classical theory of complexity classes and its 
quantum counterpart address this kind of problems. 

All calculations that can be performed in a classical computer can also be performed in 
a quantum computer. One simply replaces the irreversible gates of the classical computer 
with their reversible counterparts. The new circuit can be implemented in a quantum 
computer. But there is no advantage in this procedure: why build a very expensive 
quantum machine which behaves classically? The appeal of quantum computation is the 
possibility of quantum algorithms faster than classical ones. The quantum algorithms 
must use quantum features not available in classical computers, such as quantum par- 
allelism and entanglement, in order to enhance the computation. On the other hand, a 
naive use of quantum features does not guarantee any improvements. So far, there are 
only two classes of successful quantum algorithms: the database search algorithms and 
the algorithms for finding the generators of a normal subgroup of a given group. Shor's 
algorithms for integer factorization and discrete logarithm are special cases of this latter 
class. 
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3 The Quantum Computer 



In quantum computers, one is allowed to use quantum states instead of classical ones. 
So, the electric potential can be replaced by some quantum state: the quantum bit (qubit 
for short). Just as a bit has a state or 1, a qubit also has a state |0) or |1). This is called 
the Dirac notation and it is the standard notation for states in Quantum Mechanics. The 
difference between bits and qubits is that a qubit can also be in a linear combination 
of states |0) and |1): 

M=a|0> + /3|1>. (1) 

This state is called a superposition of the states |0) and |1) with amplitudes a and (3 
(a and f3 are complex numbers). Thus, the state is a vector in a two-dimensional 
complex vector space, where the states |0) and |1) form an orthonormal basis, called the 
computational basis (see Fig. 0in the real case). 

The state |0) is not the zero vector, but simply the first vector of the basis. The 
matrix representations of the vectors |0) and |1) are given by 

and |1) = 

1 1 1 

What is the interpretation of a and (3 in Eq. ([Tjl? Quantum mechanics tells us that if one 
measures the state |V>) one gets either |0), with probability \a\ 2 , or |1), with probability 
|/3| 2 . That is, measurement changes the state of a qubit. In fact, any attempt to find out 
the amplitudes of the state l^) produces a nondeterministic collapse of the superposition 
to either |0) or |1). If \a\ 2 and |/3| 2 are probabilities and there are only two possible 
outputs, then 

\a\ 2 + \P\ 2 = l. (2) 



|0> 




Figure 5: Computational basis for the case a, (3 real. In the general case (a, fi 
complex) there is still a geometrical representation called the Bloch sphere UJ. 
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Calculating the norm of \ip), Eq. © gives 



1. 



If a qubit is in state given by Eq. (fTjl. there are two ways it can interact. The 
first one is a measurement. This forces the state to collapse to either |0) or |1) with 
probabilities \a\ 2 and |/3| 2 , respectively. Note that the measurement does not give the 
value of a and (3. They are inaccessible via measurements unless one has many copies of 
the same state. The second kind of interaction does not give any information about the 
state. In this case, the values of a and (3 change keeping the constraint (J2J). The most 
general transformation of this kind is a linear transformation U that takes unit vectors 
into unit vectors. Such transformation is called unitary and can be defined by 

u ] u = uu ] 



(u 



*\T 



'* indicates complex conjugation and T indicates the transpose oper- 



where 
ation) . 

To consider multiple qubits it is necessary to introduce the concept of tensor product. 
Suppose V and W are complex vector spaces of dimensions m and n, respectively. The 
tensor product V tg> W is an mn-dimensional vector space. The elements of V <S> W 
are linear combinations of tensor products \v) £3 \ w), satisfying the following properties 
{z G C, \v), \vi), \v 2 ) G V, and \w), \w\), \w 2 ) G W): 

1. z(\v) (8> \w)) = (z\v)) \w) = \v) (z\w)), 

2. (\vi) + \v 2 }) ® \w) = (\vi) 8) \w)) + (|u 2 ) (B) \w}), 

3. \v) ® (\wi) + \w 2 }) = (\v) (8) \wi)) + (\v) ® \w 2 )). 

We use also the notations \v,w) or \vw) for the tensor product \v) \w). Note 

that the tensor product is non-commutative, so the notation must preserve the ordering. 

Given two linear operators A and B defined on the vector spaces V and W, respec- 
tively, we can define the linear operator A <g> B on V <8> W as 



(A 8) B)(\v) \w)) = A\v) 8) B\w), 
where \v) G V and \w) G W. The matrix representation of A <g> B is given by 

AnB ■ ■ ■ A\ m B 



A®B 



A R 



(3) 



(4) 



A m \B ■ 

where A is an m x m matrix and B is a n x n matrix (We are using the same notation 
for the operator and its matrix representation) . So the matrix A ® B has dimension 
mn x ran. For example, given 



A 




1 



and B 
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the tensor product A <g> B is 



A(g>B 



1 

1 







1 
10 
1 



1 

1 

1 

1 
1 
1 



The formula Q can also be used for non square matrices, such as the tensor product of 
two vectors. For example, the tensor product |0) <g> |1) is given by 



|0> 



101) 



1 









1 







1 












The notations \ijj)® k and A m mean and A tensored with themselves k times, respec- 
tively. 

The general state of two qubits is a superposition of the states 1 00) , |01), |10), 
and 1 11): 

|V) =a|00)+/?|01)+7|10> + <f|ll>, (5) 



with the constraint 



|a| 2 + |/?| 2 + l7| 2 + |5| 2 = l. 



Regarding the zeroes and ones as constituting the binary expansion of an integer, we can 
replace the representations of states 



by the shorter forms 



|00), |01), 1 10), |11), 
|0>, |1>, |2>, |3), 



in decimal notation. 

In general, the state of n qubits is a superposition of the 2 n states |0), |1), 
\2 n - 1): 

2 n -l 



i=0 



with amplitudes 014 constrained to 



2 n -l 



EN 2 = !- 

The orthonormal basis {|0) , . . . , |2 n — 1)} is called computational basis. As before, a 
measurement of a generic state yields the result \iq) with probability |aj | 2 , where 
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< iq < N. Usually, the measurement is performed qubit by qubit yielding zeroes or 
ones that are read together to form iq. We stress again a very important feature of the 
measurement process. The state as it is before measurement is inaccessible unless it 
is in the computational basis. The measurement process inevitably disturbs \ip) forcing it 
to collapse to one vector of the computational basis. This collapse is non-deterministic, 
with the probabilities given by the squared norms of the corresponding amplitudes in 

If we have two qubits, one in the state 

\<p) =a|0> + 6|l> 

and the other in the state 

M=c|0> + d|l>, 
then the state of the pair l^)]^) is the tensor product 

Ip)®^) = (o|0) + 6|l))®(c|0)+d|l)) (6) 
= ac|00) +ad|01) + bc\W) +bd\U). 

Note that a general 2-qubit state © is of the form © if and only if 

a = ac, 
(3 = ad, 
7 = be, 
5 = bd. 

^,From these equalities we have that a general 2-qubit state (JHJ is of the form @ if and 
only if 

a5 = /?7. 

Thus, the general 2-qubit state is not a product of two 1-qubit states. Such non-product 
states of two or more qubits are called entangled states, for example, ( 1 00) + |ll))/v2- 

There is an inner product between two n-qubit states \ip) and \ifi), written in the form 
(<p\ip), which is defined by the following rules in a complex vector space V: 

1. = 

2. {<p\(a\u) + b\v))) = a(ip\u) + b{ip\v), 

3. (cp\<p) > if |^) / 0, 

where a, b £ C and \<p), \u), \v) £ V. The norm of a vector \<p) is given by 

II \<p) II = V(<p\<p)- 
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The notation {ip\ is used for the dual vector to the vector \<p). The dual is a linear 
operator from the vector space V to the complex numbers, defined by 



(tp\(\v)) = (<p\v), V|«)€V. 



Given two vectors \ip) and \ip) in a vector space V, there is also an outer product 
\t/j)((p\, defined as a linear operator on V satisfying 



If \(p) = a\0) +b\l) and 
and outer products are: 

<</#> 



(W)(<p\)\v) = W)(<p\v), V|«>€V. 

= c|0) + d\l), then the matrix representations for inner 



a* b* 



c 
d 



a 
b 



c* d* 



a*c + b*d, 

ac* ad* 
be* bd* 



Notice the complex conjugation in the process of taking the dual. 

After the above review, we are ready to outline the quantum computer. Fig. El is the 
generalization of Fig. ^ to the quantum case. The function / is replaced by a unitary 
operator U and classical bits are replaced by quantum bits, where each one has a state 
\ipi). In Fig. El we are taking a non-entangled input, what is quite reasonable. In fact, 
\ipi) is either |0) or |1) generally. on the right hand side of Fig. is the result of 
the application of U on the input. The last step is the measurement of the states of 
each qubit, which returns zeroes and ones that form the final result of the quantum 
calculation. Note that there is, in principle, an infinite number of possible operators U, 
which are unitary 2 n x 2 n matrix, with continuous entries. In particular, one must take 
errors into account, which reduces the number of implementable circuits. But even in 
this case, the number of degrees of freedom is greater than in the classical case. 



|V>2> 




Figure 6: The sketch of the quantum computer. We consider the input non- 
entangled, which is reasonable in general. On the other hand, the output is 
entangled in general. The measurement of the state not shown here, returns 
zeroes and ones. 
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Similarly to the classical case, the operator U is in general written in terms of gates 
forming a quantum circuit, which is the topic of the next section. 



4 Quantum Circuits 

Let us start with one-qubit gates. In the classical case there is only one possibility, which 
is the NOT gate, like the ones used in Fig. |2j The straightforward generalization to the 
quantum case is given in Fig. Q where X is the unitary operator 



X 



1 

1 



So, if \tp) is |0), the output is |1) and vice-versa. But now we have a situation with no 
classical counterpart. The state \tp) can be a superposition of states |0) and |1). The 
general case is given in Eq. (^Q). The output in this case is a\l) + /3|0). 

The gate X is not the only one-qubit gate. There are infinitely many, since there are 
an infinite number of 2 x 2 unitary matrices. In principle, any unitary operation can be 
implemented in practice. The Hadamard gate is another important one-qubit gate, given 
by 



It is easy to see that 



H 

H\0) 
H\l) 



1 

71 



|Q) + |i) 
|Q)-|i) 

V2 



If the input is |0), the Hadamard gate creates a superposition of states with equal weights. 
This is a general feature, valid for two or more qubits. Let us analyze the 2-qubit case. 
The first example of a 2-qubit gate is H <g> H: 

H® 2 \0)\0) = {H®H){\0)®\0))=H\0)®H\0) 

|o> + |i)W|o> + |i> 



V2 







V2 



i(|0)|0) + |0)|l) + |l)|0) + |l)|l)) 
~(|0) + |1) + |2) + |3». 



X 



x\ 



Figure 7: Quantum NOT gate. 
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The result is a superposition of all basis states with equal weights. More generally, the 
Hadamard operator applied to the n-qubit state |0) is 



2"-l 



v i=0 

Thus, the tensor product of n Hadamard operators produces an equally weighted super- 
position of all computational basis states, when the input is the state |0). 

Another important 2-qubit quantum gate is the CNOT gate, which is the quantum 
generalization of the classical gate described earlier (Fig. It has two input qubits, the 
control and the target qubit, respectively. The target qubit is flipped only if the control 
qubit is set to 1, that is, 

|oo> -> |00>, 

|01) - |01), (7) 
1 10) - |n), 
in) - |io>. 

The action of the CNOT gate can also be represented by 

| a, b) — ► | a, a ffi b), 

where ffi is addition modulo 2. Now, let us obtain its matrix representation. We know 
that 



|00) = |0)®|0) 



|01) = |0)®|1) 



1 10) 



|1}©|0) 



111) 



ID © ID 



1 




1 





© 





1 










© 


1 







1 


1 


© 













1 


© 


1 



1 







1 







1 







1 



(8) 
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Thus, from (J7J) and (jSJ), the matrix representation U CNOT of the CNOT gate is 

" 


1 

1 

Fig. |H1 describes the CNOT gate, where \i) is either |0) or |1). The figure could 
lead one to think that the output is always non-entangled, but that is not true, since if 
the first qubit is in a more general state given by a |0) + b |1), then the output will be 
a |0) \a) + b |1) X |cr), which is entangled in general. 

CNOT and one-qubit gates form a universal set of gates. This means that any other 
gate, operating on 2 or more qubits can be written as compositions and direct products 
of CNOT and one-qubit gates [T5| . 

We have seen two examples of 2-qubit gates. The general case is a 4 x 4 unitary 
matrix. Gates that are the direct product of other gates, such as H <g> H, do not produce 
entanglement. If the input is non-entangled, the output is not too. On the other hand, 
the output of the CNOT gate can be entangled while the input is non-entangled. 

The next gate we consider is the 3-qubit quantum Toffoli gate. Its action on the 
computational basis is given by 

\a, b, c) — > \a, b, c © ab). 

The action on a generic state 

l 

\tp) = ^2 a a ,b,c\a : b,c) = 

a,b,c=0 

is obtained by linearity as 

l 

|V>') = a a,b,c\a,b,c® ab) = 

a,b,c=0 



CNOT 



1 

1 







"ooo 

"101 

"no 
"in 



«ooo 

aioi 
am 
"no 



-e- 



X 1 \o) 



Figure 8: CNOT gate. 
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So, the matrix representation for the Toffoli gate becomes 

" 1 " 
01000000 
1 
00010000 

L/ Toffoli — 

00001000 
00000100 
1 
1 

Further details about quantum circuits can be found in |16L 15]. 



5 Grover's Algorithm 

Suppose we have an unstructured database with N elements. Without loss of generality, 
suppose that the elements are numbers from to N — 1. The elements are not ordered. 
Classically, we would test each element at a time, until we hit the one searched for. This 
takes an average of N/2 attempts and N in the worst case, therefore the complexity is 
O(N). As we will see, using Quantum Mechanics only 0(\HV) trials are needed. For 
simplicity, assume that N = 2 n , for some integer n. 

Grover's algorithm has two registers: n qubits in the first and one qubit in the 
second. The first step is to create a superposition of all 2 n computational basis states 
{|0) , \ 2 n — 1)} of the first register. This is achieved in the following way. Initialize the 
first register in the state |0, 0) and apply the operator H® n 

|V> = #® n |0,...,0) 
= (H\0))® n 
|0) + |1 



V2 
1 N ^ 

m E l*> • W 



N 

l — U 

is a superposition of all basis states with equal amplitudes given by 1/y/N. The 
second register can begin with |1) and, after a Hadamard gate is applied, it will be in 
state |-) = (|0) - |l»/\/2- 

Now define / : {0, N — 1} — > {0, 1} as a function which recognizes the solution: 

j.... f 1 if z is the searched element (io) 
[ otherwise. 

This function is used in the classical algorithm. In the quantum algorithm, let us assume 
that it is possible to build a linear unitary operator also dependent on /, Uf, such that 

u f (\i)\j)) = \i)\j®m). (ii) 
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Uf is called oracle. In the above equation, \i) stands for a state of the first register, so i 
is in {0, 2 n — 1}, \j) is a state of the second register, so j is in {0, 1}, and the sum is 
modulo 2. It is easy to check that 



Uf(\i)\-)) 



U f (\i)\0))-U f (\i)\l)) 

\j)\m)-\i)\i®m) 

= (-l) fii) \i)\-). (12) 
In the last equality, we have used the fact that 

ie/(0-| "° ri : io (is) 

I 1 tor i ^fc iq. 

Now look at what happens when we apply Uf to the superposition state coming from 
the first step, |— ). The state of the second register does not change. Let us call \tpi) 
the resulting state of the first register: 



N-l 



LE"/(K>i-» 



N A n 

1=0 

1 

= t^EC-^H)!-)- ( 14 ) 

\ipi) is a superposition of all basis elements, but the amplitude of the searched element 
is negative while all others are positive. The searched element has been marked with a 
minus sign. This result is obtained using a feature called quantum parallelism. At the 
quantum level, it is possible "to see" all database elements simultaneously. The position 
of the searched element is known: it is the value of i of the term with negative amplitude 
in Q14|). This quantum information is not fully available at the classical level. A classical 
information of a quantum state is obtained by practical measurements, and, at this point, 
it does not help if we measure the state of the first register, because it is much more likely 
that we obtain a non-desired element, instead of the searched one. Before we can perform 
a measure, the next step should be to increase the amplitude of the searched element 
while decreasing the amplitude of the others. This is quite general: quantum algorithms 
work by increasing the amplitude of the states which carry the desired result. After that, 
a measurement will hit the solution with high probability. 

Now we shall work out the details by introducing the circuit for Grover's algorithm 
(Fig. EJ) and analyzing it step by step. The unitary operator G is applied O(VW) times. 
The exact number will be obtained later on. The circuit for one Grover iteration G is 
given in Fig. The states \tp) and |V>i) are given by Eqs. © and (|14|). respectively. 
The operator 2 \ip) — I is called inversion about the mean for reasons that will be clear 
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Figure 9: Outline of Grover's algorithm. 
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Figure 10: One Grover iteration (G). The states of the hrst register correspond 
to the first iteration. 

in the next section. We will also show how each Grover operator application raises the 
amplitude of the searched element. I^i) can be rewritten as 



IV-i) = W) 



(15) 



where is the searched element. is a state of the computational basis. Note that 

, ., , 1 



(16) 



Let us calculate \i))g) of Fig. |§1 Using Eqs. (|T3|) and (|16j). we obtain 



1^ 



G 



(2 \1>) 

nn-2 _ 1 o 

">) + -4= 



171-2 



(17) 



This is the state of the first register after one application of G. The second register is in 
the state I—). 



6 Geometric Representation 

All the operators and amplitudes in Grover's algorithm are real. This means that all 
states of the quantum computer live in a real vector subspace of the Hilbert space. 
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This allows a nice geometrical representation taking |zq) and \ r ip) as base vectors (non- 
orthogonal basis). 

In Fig. ^2 we can see the vectors and \ip). They form an angle smaller than 90° 
as can be seen from Eq. (|16|) . since < (t/j\io) < 1- If « is large, then the angle is nearly 
90°. We can think that is the initial state of the first register, and the steps of the 
computation are the applications of the unitary operators U f and 2 l^) (^1 — I- Then 
will rotate in the real plane spanned by and |io), keeping the unit norm. This means 
that the tip of \ip)'s vector lies in the unit circle. 

^From Eqs. (fT5|) and (|T6|) we see that \ip) rotates 9 degrees clockwise, where (see l^i) 
in Fig. EJ) 

cos6» = l (18) 

^From Eq. (|T7|) we see that the angle between \iI>g) and is 

cos 9' = (^ G ) = l-^ ZI . (19) 

So, 9' = 9 and rotates 29 degrees counterclockwise (in the direction of | zq) ) . This 
explains the placement of \4>g) i n Fig- HH This is a remarkable result, since the resulting 
action of G = (2 \ tp) (ip\ — I)Uf rotates towards |io) by 9 degrees. This means that 
the amplitude of in increased and the amplitudes of i / io, decreased with 
respect to their original values in \tp). A measurement, at this point, will return |io) more 
likely than before. But that is not enough in general, since 9 is a small angle if n 3> 1 
(see Eq. (fTH)) ). That is why we need to apply G repeatedly, ending up 9 degrees closer to 
|io) each time, until the state of the first register be very close to |io), so we can measure. 

Now we show that further applications of G also rotate the state of the first register 
by 9 degrees towards The proof is quite general: suppose that \a) is a unit vector 




Figure 11: The state of the first register lives in the real vector space spanned 
by \io) and We take these states as a basis to describe what happens in 
Grover's algorithm. 



17 




Figure 12: A generic vector \a) is reflected around the horizontal axis by the 
application of Uf, yielding \<7\). Then, the reflection of \a\) about the mean \tp) 
gives G\a), which is 9 degrees closer to \io) (vertical axis). 

making an angle a\ with \ip), as in Fig. 1121 Let \a\) be the state of the first register 
after the application of Uf on |cr) | — ). Uf changes the sign of the component of \a) in 
the direction of \io). So \a\) is the reflection of \a) around the horizontal axis. Let a,2 be 
the angle between and \a±). Let us show that G\a) lies in the subspace spanned by 
\i ) and 

G\a) = (2\if>){il>\-I)U f \a) 
= 2(1>\U f \<r)\il>)-\* 1 ) 

= 2cosa 2 \ip) - \tri) . (20) 

We have omitted the state | — ) of the second register in the above calculation for simplicity. 
|<ti) lies in the subspace spanned by \io) and \ip), then G\ip) also does. 

Now we prove that the angle between \a) and G \a) is 9, which is the angle between 
|V>) and (see Fig. dj): 

(a\G\a) = 2 (<r|^) cos 02 — (o"|<Ti) 

= cos a\ cos a2 — cos(ai + 02) 

= COS(02 — Oil). (21) 

/,From Fig. ^]we see that 02 — a± is 6. From Eq. (|2T)|) we see that G\a) is a rotation of 
|<r) towards | -io) by 6 degrees. 

The geometrical interpretation of the operator 2\ip) — I is that it reflects any real 
vector around the axis defined by the vector l^). For example, in Fig. El we see that 
G\a) = (2\ip) — I) is the reflection of |<7i) around \ip). 2\tp) (tp\ — I is called 
inversion about the mean for the following reason. Let \a) = Y^,=q 1 a i K) be a generic 
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vector and define (a) = J2i=o 1 a % ( m ean of the amplitudes of |cr) ) . Denning 

W) = E fa - ^)) i*> > ( 22 ) 

results 

(2 i^xvi - -o K> = - K> - (23) 

The above equation shows that a vector with amplitudes crj — (<r) is transformed to a 
vector with amplitudes — (cr, — (<r)). Note that \a') is not normalized, but this is irrelevant 
in the above argument because the amplitudes of \a) and \a l ) only differ by a minus sign. 
Uf also has a geometrical interpretation, which can be seen from the expression 

U f = I-2\i ){i \, (24) 

which yields 

cr /W = ( l *>'f*-?- i ° ■ (25) 

( - ho) , if « = «0- 

Therefore, the above representation for [// is equivalent to Eq. (|12jl if we do not consider 
the state of the second register. The geometrical interpretation is: Uf reflects a generic 
vector about the plane orthogonal to \iq). This is what Eq. (|25|) shows for vectors of 
the computational basis. The interpretation is valid for a generic vector because Uf is 
linear. We have not used Eq. to define U f before, because we do not know iq before 
running the algorithm. On the other hand, we assumed that it is possible somehow to 
use function / given by Eq. (|10[). and to build Uf as given by Eq. ([lip. 



7 An Example: Grover for N = 8 

We describe Grover's Algorithm for a search space of 8 elements. If JV = 8 then n = 3. 
There are 3 qubits in the first register and 1 qubit in the second register. For N = 8, the 
operator G will be applied 2 times as we will see in Eq. (|5U[) . The circuit in this case is 
given in Fig. 1131 The oracle is queried 2 times. Classically, an average of more than 4 
queries are needed in order to have a probability of success of more than 1/2. 

Let us describe the quantum computer state at each step shown in the circuit (\ipo) , \ , 
l^i) ; 1^2) ) 1^3) , and \ipf))- The initial state is 

|Vo) = |000) . (26) 

After applying Hadamard gates, 

1 7 

|V) = H® 3 |000) = (H |0)f 3 = —= K> • (27) 
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Figure 13: Grover's algorithm for N = 8. 

Suppose that we are searching for the element with index 5. Since |5) = 1 101) . 

&>(|101>|-» = - |101> |-> 
Uf(\i)\-)) = K>|-> ,ifi^5. 

Define \u) as 



1 v 



V7 : 



i = 

i 5 



Then 



|000) + |001) + |010) + |011) + 1 100) + |110) + |111) 

V7 



VT |«) + ^=|101>. 



2V2 2V2 

With this result we can see the direction of \ip) in Fig. 1141 The value of is 



6 = 2 arccos 



vr 
2V2. 



arccos | - 
, 4 

41.4°. 



The next step is 

IV>i>|-> = u f m\-)) 

/ |000) + |001) + |010) + |011) + 1 100) - |101) + |110) + |111) 

V 2V2 

Note that 1 101) is the only state with a minus sign. We can write \ipx) as 



(28) 



(29) 



(30) 



(31) 



-)(32) 



|Vi) = |V>-^|ioi) 



(33) 
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or 

The form of Eq. (|33|) is useful in the next step of calculation, since we have to apply 
2 {ip\ — I. The form of Eq. 1)34(1 is useful to draw in Fig. 1141 \tp\) is the reflection 
of \tp) with respect to \u). 
Next we calculate 

Using Eq. ((SSI), we get 



\^ 2 ) = (2 |^) (if>\ - I) . (35) 



and, using Eq. (|3Uj). 



I'M = 5 M + |101) (36) 



l « = ^ l " > + i^ |1 ° 1> - (37) 



Let us confirm that the angle between and \ip2) is 0: 

cos = <V# 2 > = ^ + ^= (V|101) = I (38) 

which agrees with Eq. ()31|) . This completes one application of G. 
The second and last application of G is similar. | is given by 

™ = &™--£a m - (39) 

Using Eq. (|3fl|) . we have 

|V3) = ^IV)-^|ioi). (40) 
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\ips) is the reflection of |^) with respect to \u). 
The last step is 

|V/> = (2|V> (VI-/) l^- 
Using Eqs. (|3UJ) and (gOl), we have 



^|.) + J4|101) 



8\/2 



8^/2 



(41) 



(42) 



It is easy to confirm that \ipf) and \ip2) form an angle 0. Note that the amplitude of 
the state 1 101) is much bigger than the amplitude of any other state \i) (i ^ 5) in Eq. 
(|42|) . This is the way most quantum algorithms work. They increase the amplitude of 
the states that carry the desired information. A measurement of the state \ipf) in the 
computational basis will project it into the state 1 101) with probability 



P 



11 



8^2 



0.945. 



(43) 



The chance of getting the result 1 101) , which reads as number 5, is around 94, 



8 Generalization 

The easiest way to calculate the output of Grover's Algorithm is to consider only the 
action of G instead of breaking the calculation into the action of the oracle (Uf) and 
the inversion about the mean. To this end, we choose \iq) and \u) as the basis for the 
subspace where \ip) rotates after successive applications of G. | «o ) is the searched state 
and \u) is defined as in Eq. (|2*9*|) . 



N-l 



i = 
i ^ i 



N 1 

Ub) - - i ) . (44) 

[From the first equation above we easily see that (io|^) = 0, i.e., \iq) and \u) are orthog- 
onal. From the second equation we have 



The state of the quantum computer at each step is 



1 _ 1 | U ) + _L \ io ) . (45) 



G k |V>) = cos -—- 9 \u) + sin -^—6 \i ) , (46) 
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where we have dropped the state of the second register since it is |— ) all the time. Ea.(|46[) 
is obtained from Fig. El after analyzing the components of G k The value of 9 is 
obtained substituting k for in Eq. (|4b[) and comparing it with Eq. I|45j) . 



2 arccos \ / 1 



1 

N' 



(47) 



Eq. (|47t|) expresses the fact we proved in section El that each application of G rotates the 
state of the first register by 9 degrees towards |io). Fig. ITol shows successive applications 
of G. 

The number of times ko that G must be applied obeys the equation 



k Q 6 + 



7T 



Since ko must be integer, we write 



ko = round 



7T-9 
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(48) 



(49) 



where 6 is given by Eq. (|47jl. If N S> 1, by Taylor expanding Eq. (|TT|) . we get 9 rj 2/yiV 
and from Eq. I|49|). 

fe = round Qv 7 ^) . (50) 

After applying G fco times, the probability p of finding the desired element after a mea- 
surement is 

2 /2/co + l 



p = sin 



(51) 



Fig. 1161 shows p for n from 2 to 30. Recall that N = 2 n , so for n = 30 the search 
space has around 1 billion elements. For n = 2 the probability of getting the result is 
exactly 1. The reason for this is that Eq. (|47|) yields 6 = tt/3 and \tp) makes an angle 
7r/6 with |u). Applying G one time rotates to |io) exactly. For n = 2, Eq. (joTj) yields 
p ~ 0.945 which is the result (|43|) of the previous section. 




Figure 15: Effect of G on 
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Figure 16: Probability of succeeding as a function of n. 

9 Grover Operator in Terms of the Universal Gates 

In this section we go in the opposite direction. We decompose G in terms of universal 
gates, which are CNOT and one-qubit gates. This decomposition shows how to implement 
G in practice. Let us begin by decomposing the inversion about the mean 2 \nji) — I. 
Recall that 

= H® n |0> . (52) 

Then 

2 (ip\-I = H® n {2 |0> (0| - I)H® n . (53) 

This equation shows that it is enough to consider the operator 2 |0) (0| — /, which inverts 
a generic vector about the vector |0). The circuit for it is given in Fig. 1171 One can 
convince oneself that the circuit gives the correct output by following what happens to 
each state of the computational basis. The input |0) is the only one that does not change 
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Figure 17: Circuit for 2 |0) (0| — /. Note the presence of the imaginary unit, 
which does not affect the real character of the operator. 
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signal. The intermediate states as shown in Fig. 1171 are 



IV-o) = 


10) 


10) 


IV>i> = 


11) 


11) 


|V>2> = 


i\l) 


11) 


|V>3> = 


i\l) 


11) 


|V>4> = 




11) 


life) = 


10) 


|0) 



|o> |o> 

11)11) 

l=L> I — > 
|l>(-|-» 

|0)|0). 



(54) 



The same calculations for the input \j), < j < N, results in — \j) as output. 

The only operator in Fig. El that does not act on single qubits is the generalized 
Toffoli gate, which is shown alone in Fig. 1181 The decomposition of the generalized 
Toffoli gate in terms of Toffoli gates is given in Fig. 1191 The n — 2 work qubits are 
extra qubits whose input and output are known a priori. They are introduced in order 
to simplify the decomposition. A careful analysis of Fig. IT9*1 shows that the output is the 
same of the generalized Toffoli gate with the extra work qubits. 

The final step is the decomposition of the Toffoli gate, which is given in Fig. 1201 
where S is the phase gate 

r 1 

i 



S 



(55) 



and T is the ir/8 gate 





= 27r/4 



(56) 



This decomposition can be verified either by an exhaustive calculation of tensor products 
and operator compositions or by an exhaustive application of operators on basis elements. 

By now one should be asking about the decomposition of Uf in terms of elementary 
gates. Uf has a different nature from other operators in Grover's algorithm, since its 
implementation depends on how data is loaded from a quantum memory of a quantum 
computer. On the other hand, we have pointed out that Uf can be represented by 
I — 2 (iq\ (Eq. (|24jl). if one knows the answer iq a priori. This representation is 
useful for simulating Grover's algorithm in a classical computer to test its efficiency. The 
operator 1 — 2 \iq) {iq\ is decomposed as a generalized Toffoli gate with n control qubits, 
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Figure 18: Generalized Toffoli gate. 
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Figure 19: Decomposition of the generalized Toffoli gate in terms of Toffoli gates. 
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Figure 20: The Toffoli gate in terms of CNOT and one-qubit gates. 



one target qubit in the state |— ), and two symmetrical X gates in the ith qubit, if the 
ith binary digit of iq is 0. For example, the operator Uf used in section for N = 8 (see 
Eq. P%|>) is given in Fig. EU 

In section 1, we have pointed out that the efficiency of an algorithm is measured by 
how the number of elementary gates increases as a function of the number of qubits. 
Counting the number of elementary gates (Figs. EJ El El EB and |2*U|). and using Eq. 
()5(J|) . we get 7r(17n — 15)\/2™ + n + 2, which yields complexity 0(ny/2™), or equivalently 
0(\/2"). The notation 6(iV) means 0(poly(log(iV))7V). 
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Figure 21: Decomposition of 7 — 2 1 101) (101 1 , which simulates Uf that searches 
number 5. 
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